Each aircraft engine is controlled and monitored by a dedicated control unit, such as a Full Authority Digital Engine Computer (FADEC). The control units are connected to an interface device, such as a Flight Management Guidance Envelope Computer (FMGEC) for managing the flight, the guidance and the flight envelope of the aircraft. The FMGEC computer harmonizes the controlling of the two engines by the FADEC control units.
Each FADEC control unit automatically activates a protection mode when the engine controlled by the FADEC exhibits an operational anomaly. The activation of a protection mode results in the virtually instantaneous shutting down of the engine to protect the integrity of the engine and consequently to subsequently avoid extensive repair operations on the ground.
In a known way, the interface device, e.g. FADEC, uses logic for inhibiting the protection modes to ensure that a protection mode can only be activated automatically on just one of the two engines. Each engine of a twin engine aircraft is sized so that by itself it can provide sufficient power to the aircraft for an emergency landing, at least under optimum safety conditions. While one engine is shut down and the other engine exhibits an operational anomaly, the logic of the interface device prevents an automatic shutdown of the one remaining operational engine. The one remaining operating engine can be shut down by the pilot who may issue a shutdown command, after the pilot evaluates the parameters of the engine.
This logic of the interface device, e.g., FMGEC, of shutting down one but not both engines is best adapted to flight phases such as aircraft climb after a take-off or aircraft descent before a landing since. During these take-off and landing phases, a pilot does not have sufficient time to restart a shutdown engine and must make best use of the power provided by the second engine, even if the second engine is exhibiting an operational anomaly.